Experimental: automated "Missing Dependency" help on PRs — feedback welcome

[Demitrius Nelon (denelon)]

Warning

This is an experimental automation. The comments it posts are advisory only, may be wrong, and never change the state of your PR. We are sharing it early to gather your feedback.

What it is

We're piloting a small, focused automation that tries to make one specific validation failure easier to fix on your own: Validation-Missing-Dependency.

When our validation pipeline can't resolve a package dependency declared in a submitted manifest, it applies the Validation-Missing-Dependency label. Today that label points you at general documentation. This pilot goes one step further: it reads the manifest and the validation log, works out which dependency is missing and why, and posts a single comment with a specific, recommend-only suggestion — for example, "the dependency X now exists, so validation just needs to be re-run" versus "the declared ID Y isn't a valid package identifier; use Y.x64 / Y.x86 instead."

What it will and won't do

• ✅ Posts at most one comment per PR (per update), clearly marked as experimental.
• ✅ Only acts on PRs labeled Validation-Missing-Dependency.
• ✅ Reads manifests and the public validation log only.
• ❌ Never approves, merges, closes, waives, or re-runs validation.
• ❌ Never applies or removes labels.
• ❌ Never touches PRs flagged with any security/malware label.
• ❌ Never posts moderation trigger commands (e.g. @wingetbot ...).

A human maintainer remains fully in control of every PR.

Why we're doing this

We want to help contributors resolve routine validation failures faster and with less back-and-forth — going beyond a label with links to static documents, toward specific, contextual guidance. Missing-dependency is our first, narrow test case. If it proves genuinely helpful and low-noise, we may extend the same approach to other well-understood, author-fixable failure classes.

We'd love your feedback

Please reply here if you notice any of the following:

• A suggestion that was wrong or misleading (please link the PR).
• A comment that was unhelpful, noisy, or redundant.
• Tone or wording that could be clearer or friendlier.
• Cases where you'd want the automation to stay quiet.
• Anything else — including "this saved me time," which helps us gauge value.

Thanks for helping us shape this responsibly. 🙏